HTML JWT Generator

HTML JWT generator quickstart

Create a token with your public API key in the sub claim, a near-term Unix timestamp in exp, and an HS256 signature made with your private API key.

Sapling JWTs use HS256 with a sub claim containing your public API key and an exp claim containing a Unix timestamp. The examples use a one-hour lifetime; shorten it further when your application can refresh tokens easily.

HTML HS256 · sub + exp

Never sign a JWT in browser code. Have your backend return a short-lived token without exposing the private API key.

<script src="https://sapling.ai/static/js/sapling-sdk-v1.1.1.min.js"></script>
<script>
async function initializeSapling() {
  if (typeof Sapling === 'undefined') {
    throw new Error('Sapling SDK failed to load.');
  }

  const response = await fetch('/api/sapling-token', {
    credentials: 'same-origin',
  });

  if (!response.ok) {
    throw new Error(`Token request failed: ${response.status}`);
  }

  const {token} = await response.json();
  Sapling.init({key: token});
}

initializeSapling().catch(console.error);
</script>

The application-owned /api/sapling-token route should use one of the server-side examples in this directory and return {"token":"..."}.

Generated token text/plain

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.<base64url-claims>.<signature>

Return the compact token to the browser and pass it to Sapling.init as the key. Issue a fresh token after it expires; never send the private key.

Reference Frontend key management and JWT documentation All languages Choose another quickstart

About HTML

HTML, the HyperText Markup Language is used to design web pages to be rendered in browsers. Typically it is combined with CSS for styling and presentation and JavaScript for dynamic functionality.